16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9

Analysis

max time kernel
150s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
Size

206KB
MD5

7b6610873a942a19ac3e87417d608122
SHA1

aa9f84ebef971e394f994a45367ca3e3f0309e99
SHA256

16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9
SHA512

218e07927a305a0bc1c5379e0e7dd05ae029465317c5866564eb7b2d541d22528cb94ac54339dffd8f19ceeab02c32f333b49198d1b75dfba6a8836989d3ef6f
SSDEEP

3072:zvEfVUzSLhIVbV6i5LirrlZrHyrUHUckoMQ2RN6unpC:zvEN2U+T6i5LirrllHy4HUcMQY6UC

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1936	explorer.exe
748	spoolsv.exe
1912	svchost.exe
1120	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe

Loads dropped DLL 8 IoCs

pid	Process
1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
1936	explorer.exe
1936	explorer.exe
748	spoolsv.exe
748	spoolsv.exe
1912	svchost.exe
1912	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
1936	explorer.exe
1936	explorer.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe
1912	svchost.exe
1912	svchost.exe
1936	explorer.exe
1936	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1936	explorer.exe
1912	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
1936	explorer.exe
1936	explorer.exe
748	spoolsv.exe
748	spoolsv.exe
1912	svchost.exe
1912	svchost.exe
1120	spoolsv.exe
1120	spoolsv.exe
1936	explorer.exe
1936	explorer.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1936	1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe	26
PID 1348 wrote to memory of 1936	1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe	26
PID 1348 wrote to memory of 1936	1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe	26
PID 1348 wrote to memory of 1936	1348	16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe	26
PID 1936 wrote to memory of 748	1936	explorer.exe	27
PID 1936 wrote to memory of 748	1936	explorer.exe	27
PID 1936 wrote to memory of 748	1936	explorer.exe	27
PID 1936 wrote to memory of 748	1936	explorer.exe	27
PID 748 wrote to memory of 1912	748	spoolsv.exe	28
PID 748 wrote to memory of 1912	748	spoolsv.exe	28
PID 748 wrote to memory of 1912	748	spoolsv.exe	28
PID 748 wrote to memory of 1912	748	spoolsv.exe	28
PID 1912 wrote to memory of 1120	1912	svchost.exe	29
PID 1912 wrote to memory of 1120	1912	svchost.exe	29
PID 1912 wrote to memory of 1120	1912	svchost.exe	29
PID 1912 wrote to memory of 1120	1912	svchost.exe	29
PID 1912 wrote to memory of 1176	1912	svchost.exe	30
PID 1912 wrote to memory of 1176	1912	svchost.exe	30
PID 1912 wrote to memory of 1176	1912	svchost.exe	30
PID 1912 wrote to memory of 1176	1912	svchost.exe	30
PID 1912 wrote to memory of 564	1912	svchost.exe	32
PID 1912 wrote to memory of 564	1912	svchost.exe	32
PID 1912 wrote to memory of 564	1912	svchost.exe	32
PID 1912 wrote to memory of 564	1912	svchost.exe	32
PID 1912 wrote to memory of 956	1912	svchost.exe	34
PID 1912 wrote to memory of 956	1912	svchost.exe	34
PID 1912 wrote to memory of 956	1912	svchost.exe	34
PID 1912 wrote to memory of 956	1912	svchost.exe	34

C:\Users\Admin\AppData\Local\Temp\16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe
"C:\Users\Admin\AppData\Local\Temp\16bcbe22b0e671c478bb092bdb22f43a811a06d1e101c3e3428243849e1da6b9.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348
- \??\c:\windows\system\explorer.exe
  c:\windows\system\explorer.exe
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - \??\c:\windows\system\spoolsv.exe
    c:\windows\system\spoolsv.exe SE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:748
  - - \??\c:\windows\system\svchost.exe
      c:\windows\system\svchost.exe
      4⤵
      Modifies WinLogon for persistence
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Modifies Installed Components in the registry
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1912
    - - \??\c:\windows\system\spoolsv.exe
        
        c:\windows\system\spoolsv.exe PR
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1120
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:45 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:1176
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:46 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:564
    - - C:\Windows\SysWOW64\at.exe
        
        at 16:47 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
        5⤵
        
        PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mrsys.exe

Filesize
207KB

MD5
5b010f4d1a2fcdc962aea952716ef254

SHA1
3c541cc0de54b3cca86c5f40d6a9476103f4dcc2

SHA256
48c91929fbae2f77b7e19d7aa91239892f48ceea131aa4d82b3f3bf2908edf47

SHA512
ac085a2269ed5255e485ec5fb4743851350a39bd8d34692e03c89f6e1f16f12138c1e5cf78de1bfd0376c6c9356336994b786a6016932d19a99e5bee8fab0b59

Download Submit
C:\Windows\system\explorer.exe

Filesize
206KB

MD5
baf63fd9445cacc92cacaa7b571d4005

SHA1
ca6599da7eeb1f5b86ff17013a496813487b57bf

SHA256
a636668d8f58fe0cdac49fe1ff77ba475ba1cd21b4c4f1760905acb54d2538e8

SHA512
148427ddfe4c98634bb8daf9a10eedcb85fdbfc9ef80077c28b789c14dc932e2413b7816b1bfdc98b4cc1f54a53929ad0cb857b0bd2d849c1a2f9d3112f4c0eb

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
C:\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
C:\Windows\system\svchost.exe

Filesize
206KB

MD5
db59c909310480f7d7ffbf644c601d06

SHA1
c4a54f383013314b2c521b7d5564f9204c008227

SHA256
26b4df8aed798e487042b5d45f120f76930bbd924c263811e27f753554838815

SHA512
7d74f54698b9f646d5fc7e979fdb9d3b4935d8c856f2f4efbd9395a648be9382066972a083b58f2fb628927406f25feffe5c26833ef30ada2681de76dfdacdd9

Download Submit
\??\c:\windows\system\explorer.exe

Filesize
206KB

MD5
baf63fd9445cacc92cacaa7b571d4005

SHA1
ca6599da7eeb1f5b86ff17013a496813487b57bf

SHA256
a636668d8f58fe0cdac49fe1ff77ba475ba1cd21b4c4f1760905acb54d2538e8

SHA512
148427ddfe4c98634bb8daf9a10eedcb85fdbfc9ef80077c28b789c14dc932e2413b7816b1bfdc98b4cc1f54a53929ad0cb857b0bd2d849c1a2f9d3112f4c0eb

Download Submit
\??\c:\windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
\??\c:\windows\system\svchost.exe

Filesize
206KB

MD5
db59c909310480f7d7ffbf644c601d06

SHA1
c4a54f383013314b2c521b7d5564f9204c008227

SHA256
26b4df8aed798e487042b5d45f120f76930bbd924c263811e27f753554838815

SHA512
7d74f54698b9f646d5fc7e979fdb9d3b4935d8c856f2f4efbd9395a648be9382066972a083b58f2fb628927406f25feffe5c26833ef30ada2681de76dfdacdd9

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
baf63fd9445cacc92cacaa7b571d4005

SHA1
ca6599da7eeb1f5b86ff17013a496813487b57bf

SHA256
a636668d8f58fe0cdac49fe1ff77ba475ba1cd21b4c4f1760905acb54d2538e8

SHA512
148427ddfe4c98634bb8daf9a10eedcb85fdbfc9ef80077c28b789c14dc932e2413b7816b1bfdc98b4cc1f54a53929ad0cb857b0bd2d849c1a2f9d3112f4c0eb

Download Submit
\Windows\system\explorer.exe

Filesize
206KB

MD5
baf63fd9445cacc92cacaa7b571d4005

SHA1
ca6599da7eeb1f5b86ff17013a496813487b57bf

SHA256
a636668d8f58fe0cdac49fe1ff77ba475ba1cd21b4c4f1760905acb54d2538e8

SHA512
148427ddfe4c98634bb8daf9a10eedcb85fdbfc9ef80077c28b789c14dc932e2413b7816b1bfdc98b4cc1f54a53929ad0cb857b0bd2d849c1a2f9d3112f4c0eb

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
\Windows\system\spoolsv.exe

Filesize
206KB

MD5
142073b8dee206b21c1d8e27cc7fc045

SHA1
740fe283e3c827fe372056daee9cd8eea1f68493

SHA256
38b80710d2b768cc9f432fd5784013d6d0f66863d5ac4980a412b4be4363cf4c

SHA512
6c7e3290341fd71b9d7910bbda1bf4686ddfbeea24b4dfe05e676f393d337f54266d6c61d822ee389148cadc4f76bb425166b603d71e922cf15ae5e7c61d5495

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
db59c909310480f7d7ffbf644c601d06

SHA1
c4a54f383013314b2c521b7d5564f9204c008227

SHA256
26b4df8aed798e487042b5d45f120f76930bbd924c263811e27f753554838815

SHA512
7d74f54698b9f646d5fc7e979fdb9d3b4935d8c856f2f4efbd9395a648be9382066972a083b58f2fb628927406f25feffe5c26833ef30ada2681de76dfdacdd9

Download Submit
\Windows\system\svchost.exe

Filesize
206KB

MD5
db59c909310480f7d7ffbf644c601d06

SHA1
c4a54f383013314b2c521b7d5564f9204c008227

SHA256
26b4df8aed798e487042b5d45f120f76930bbd924c263811e27f753554838815

SHA512
7d74f54698b9f646d5fc7e979fdb9d3b4935d8c856f2f4efbd9395a648be9382066972a083b58f2fb628927406f25feffe5c26833ef30ada2681de76dfdacdd9

Download Submit
memory/1348-57-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download